Privacy Policy

What we collect

Account & sign-in. You can sign in with passwordless email (a one-time link sent to your inbox) or with your Google account — we never see or store a password either way. Your email address is your account identifier. See “Signing in with Google” below for exactly what Google shares with us and what we do with it.

Orders. When you check out, we collect the shipping address you provide and keep a record of what you ordered, its price, and its status, so we can fulfill it and so you can view your order history.

Payment. We do not process or store your card details ourselves. Payment is handled entirely by Stripe, our payment processor; we only receive confirmation that a payment succeeded and a reference id for it.

Shipping. To buy postage and generate tracking, your shipping address is shared with EasyPost (our shipping platform) and the carrier it books through (Canada Post). We currently ship within Canada only.

Buylist submissions. If you sell cards to us, we collect the cards you're offering, your chosen payout method, and the address needed for you to ship them to us.

Order claims. If you report a damaged or incorrect item, any photos you upload are stored in a private file store — they are never made public, and are only ever accessed by us (or shown back to you) through a short-lived, individually generated link.

Cart & browsing. A small anonymous cookie identifies your cart before you sign in, so items you add aren't lost or sold out from under you while you browse. It doesn't identify you personally on its own.

Signing in with Google

“Continue with Google” is an optional alternative to email sign-in. If you use it, Google asks you to approve sharing basic profile information with Gatehouse Games. This section describes exactly how we handle that information.

What we access. Only the basic sign-in information Google provides for every “Sign in with Google” request: your Google account email address, your name, and your profile picture URL. We do not request access to your Gmail, Google Drive, Calendar, Contacts, or any other Google service or data, and we do not request any sensitive or restricted Google API scopes.

How we use it. Solely to authenticate you and create or sign in to your Gatehouse Games account. Your email address is used as your account identifier and to send the order, shipping, buylist, and claim emails described below. If you already have an account with the same email address (for example from a previous email sign-in), Google sign-in is linked to that existing account rather than creating a second one. Our own account and checkout features do not read or display your Google name or profile picture; any name or phone number shown in your account is what you type in yourself.

What we don't do with it. We do not sell it, rent it, or use it for advertising or profiling of any kind. We do not share it with data brokers, use it to make credit or lending decisions, or use it to train any artificial-intelligence or machine-learning model. We do not send it to our AI deck-building features.

Who it's shared with. The information Google provides is handled only by Supabase, the authentication and database provider that runs our sign-in and stores our account records, and by our hosting provider (Vercel) as part of serving the site. It is not disclosed to anyone else, except where required by law.

How it's protected. All traffic between your browser and this site is encrypted with HTTPS. Account records are kept in a managed database with row-level access controls, and the credentials that can read all records are held only on our servers, never exposed to your browser.

How long we keep it, and deleting it. We keep this information for as long as your account exists. To have your account and this information deleted, email orders@gatehousegames.ca from the address on your account and we will remove it (some records tied to completed orders or buylist payouts, such as order history, may need to be retained for bookkeeping and tax purposes). You can also withdraw Gatehouse Games' access to your Google account at any time from your Google Account's third-party connections settings; you can still sign in by email afterward.

Google API Services User Data Policy. Gatehouse Games' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we send you

Order confirmations, shipping updates, and buylist/claim status notifications are sent via Resend to the email address on your account. We don't send marketing email today, and we don't run third-party advertising or ad-tracking of any kind on this site.

Who we share it with

Only the service providers named above (Stripe for payment, EasyPost/Canada Post for shipping, Resend for email, Supabase for sign-in and our database, Vercel for hosting, and Google when you choose to sign in with it) — each only receives what it needs to do its specific job. We do not sell your information to anyone.

Your data, your choices

You can view your order, buylist, and deck-build history at any time from your account page. A self-service way to edit or delete your account isn't built yet — if you'd like your information corrected or removed, contact us and we'll handle it directly (note that some records, like completed orders, may need to be kept for bookkeeping and tax purposes).

Contact

Questions about this policy or your data — email orders@gatehousegames.ca.